Lion Cipher Lab
Read Metasploit module output: what was tested, did it work, and what's the evidence?
- Penetration Testing / Red Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
On a real assessment nobody grades you on whether you can type `run` — they grade you on whether you can look at what came back and say, correctly and defensibly, 'this worked, here is the proof' or 'this did not work, here is why.' That reading skill is also exactly what a pentest interview tests: they paste you a wall of Metasploit output and ask 'what happened here?' Most beginners answer from the last green-looking line instead of the evidence, and get it wrong — because 'the exploit ran' and 'you got in' are different claims, and a check saying 'likely vulnerable' is not a session. This…
What you'll learn
- reading msfconsole status lines: [*] info, [+] good, [-] failure
- identifying which vulnerability a module targets from its name and check output
- telling a successful run (session opened) from a failed one at a glance
- the check-vs-exploit distinction: a positive check is not a compromise
- why 'Exploit completed' is NOT the same as 'a session was created'
- citing the single evidence line that proves your conclusion in a report
- knowing when module output is conclusive and when you must verify the session/artifact
- authorized-own-lab reporting discipline (validate, evidence, document)
Steps in this lab
- What you're doing here: reading the output, not running the tool
- The alphabet: what [*], [+], and [-] actually mean
- Which vulnerability is being tested? Read the module name and the check
- Run 1 — read this SUCCESSFUL transcript
- Run 2 — read this FAILED transcript (the important one)
- The two distinctions that separate a pro's read from a beginner's
- The third rule: when the output is conclusive, and how a pro documents proof
- Recap — the reading checklist you now own